Malware Analysis Report

2025-01-02 06:28

Sample ID 240516-e4bgnaca2z
Target e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd
SHA256 e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd

Threat Level: Known bad

The file e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Launches sc.exe

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 04:29

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 04:29

Reported

2024-05-16 04:31

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3936 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3936 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3936 wrote to memory of 2884 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\system32\cmd.exe
PID 3648 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\system32\cmd.exe
PID 1580 wrote to memory of 2132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1580 wrote to memory of 2132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3648 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 3204 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3648 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\rss\csrss.exe
PID 3648 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\rss\csrss.exe
PID 3648 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\rss\csrss.exe
PID 2896 wrote to memory of 3900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 3900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 3900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 4868 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 4868 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 4868 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 1672 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 1672 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 1672 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2896 wrote to memory of 2508 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2896 wrote to memory of 2508 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 932 wrote to memory of 5020 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 932 wrote to memory of 5020 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 932 wrote to memory of 5020 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5020 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5020 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5020 wrote to memory of 1048 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe

"C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe

"C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.113:443 www.bing.com tcp
US 8.8.8.8:53 113.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
BE 2.17.107.113:443 www.bing.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 3459a055-caab-4f3f-ad9c-ae0782913466.uuid.statscreate.org udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server12.statscreate.org udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun1.l.google.com udp
BG 185.82.216.96:443 server12.statscreate.org tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
BG 185.82.216.96:443 server12.statscreate.org tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
BG 185.82.216.96:443 server12.statscreate.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.96:443 server12.statscreate.org tcp
US 8.8.8.8:53 udp

Files

memory/3936-1-0x0000000002940000-0x0000000002D43000-memory.dmp

memory/3936-2-0x0000000002D50000-0x000000000363B000-memory.dmp

memory/3936-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2884-4-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

memory/2884-5-0x0000000003340000-0x0000000003376000-memory.dmp

memory/2884-6-0x0000000005C60000-0x0000000006288000-memory.dmp

memory/2884-7-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/2884-8-0x0000000005A60000-0x0000000005A82000-memory.dmp

memory/2884-9-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/2884-11-0x0000000006300000-0x0000000006366000-memory.dmp

memory/2884-10-0x0000000005BD0000-0x0000000005C36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fq1ol1fl.z44.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2884-21-0x0000000006480000-0x00000000067D4000-memory.dmp

memory/2884-22-0x0000000006920000-0x000000000693E000-memory.dmp

memory/2884-23-0x00000000069E0000-0x0000000006A2C000-memory.dmp

memory/2884-24-0x0000000006E80000-0x0000000006EC4000-memory.dmp

memory/2884-25-0x0000000007C70000-0x0000000007CE6000-memory.dmp

memory/2884-26-0x0000000008370000-0x00000000089EA000-memory.dmp

memory/2884-27-0x0000000007CF0000-0x0000000007D0A000-memory.dmp

memory/2884-30-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/2884-29-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/2884-28-0x0000000007EB0000-0x0000000007EE2000-memory.dmp

memory/2884-31-0x0000000071080000-0x00000000713D4000-memory.dmp

memory/2884-41-0x0000000007EF0000-0x0000000007F0E000-memory.dmp

memory/2884-42-0x0000000007F10000-0x0000000007FB3000-memory.dmp

memory/2884-44-0x0000000008000000-0x000000000800A000-memory.dmp

memory/2884-43-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/2884-45-0x00000000080C0000-0x0000000008156000-memory.dmp

memory/2884-46-0x0000000008020000-0x0000000008031000-memory.dmp

memory/2884-47-0x0000000008060000-0x000000000806E000-memory.dmp

memory/2884-48-0x0000000008070000-0x0000000008084000-memory.dmp

memory/2884-49-0x0000000008160000-0x000000000817A000-memory.dmp

memory/2884-50-0x00000000080B0000-0x00000000080B8000-memory.dmp

memory/2884-53-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/3648-55-0x0000000002920000-0x0000000002D20000-memory.dmp

memory/3648-56-0x0000000002D20000-0x000000000360B000-memory.dmp

memory/2684-66-0x00000000065B0000-0x0000000006904000-memory.dmp

memory/2684-67-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/2684-68-0x0000000070E00000-0x0000000071154000-memory.dmp

memory/2684-78-0x0000000007BA0000-0x0000000007C43000-memory.dmp

memory/2684-79-0x0000000007EB0000-0x0000000007EC1000-memory.dmp

memory/2684-80-0x0000000007F00000-0x0000000007F14000-memory.dmp

memory/3936-81-0x0000000002940000-0x0000000002D43000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/3204-94-0x0000000005ED0000-0x0000000006224000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1568d5ad72351873f4f43a3bfb90edac
SHA1 7501dbfb9c6fae394d386c723b75c59c14f3c63d
SHA256 8511e61b5b1fccb9570af4ee5c45f9bfd92cbec821e4e710eb87a68af9f23e6c
SHA512 d9332fcc28828d3b88babb1e5952618876dce28d0e5a1eeb73f2a9d9b710e6b67f109defa807ace89fdaf2bb3f4de398623664f77356d9b4197a759842ac7a74

memory/3204-97-0x0000000071400000-0x0000000071754000-memory.dmp

memory/3204-96-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/3936-107-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 24141eb0d559bc2feb811c9653e4d823
SHA1 7b30157161cb1a6b4fd59462be928ce6eb52df77
SHA256 ee9ae38870d9f21794a211f5626fab68ad941a19b0952cd94e74ec98d409102c
SHA512 f206542e1982219d491972782f428239601b310d3eb78222731395d6a8337bae928a89a8dde0caa1331508dd6ceae457a014c9256f6868744b0e003f59660ecb

memory/2360-120-0x0000000070E00000-0x0000000071154000-memory.dmp

memory/2360-119-0x0000000070C80000-0x0000000070CCC000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 6004fdf731bd0126fb74902cb28b76c9
SHA1 be61eede81bf60e5a8e95644e2efe96ef6591ed9
SHA256 e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd
SHA512 0ee80a4a68ec681a82310487688c0c77af79b54d82335f5660094c72b5738b809ac4c079e727d121940e91aa3b961c825ec6bfda41cb260c1068c635773557de

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3a1f1ff907b1785aa3a1068e66809e28
SHA1 d4ac7a369aeb940991f5b37e6d06508a1b6e8359
SHA256 60b7566083f70dc94dc6ae71b6dc3fa3bef11a6e973024138cf0cd316c4fe643
SHA512 3368e6994b26b0747a80f086556eb37f2744745bd314c67c2544c14d8851c03a25e60bc4478da2d55e71f64275d1608e5a7e08ae8f9bc574867f612c5dbe9bdd

memory/3900-146-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/3900-147-0x0000000071400000-0x0000000071754000-memory.dmp

memory/3648-158-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4868-168-0x0000000005580000-0x00000000058D4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2eb09553b89f6d48771856991513ebff
SHA1 60afccae002e708e6a8d4e25954cf1f2711c4326
SHA256 743616311e5f987bc497d732c1d7d4c478ac48a4aed037d9e5026ca5b35fa29b
SHA512 af9f2bc86bf055620860faac2ddb4f0680e1bfd01ef3813ee076ce9ef08a42ea10483123ccb2c380221e5fabadf9abaad1cb20c5e8a3a47761fd8b1f8063d251

memory/4868-170-0x0000000005B60000-0x0000000005BAC000-memory.dmp

memory/4868-171-0x0000000070BA0000-0x0000000070BEC000-memory.dmp

memory/4868-172-0x0000000070D40000-0x0000000071094000-memory.dmp

memory/4868-182-0x0000000006D90000-0x0000000006E33000-memory.dmp

memory/4868-183-0x0000000006F30000-0x0000000006F41000-memory.dmp

memory/4868-184-0x0000000005900000-0x0000000005914000-memory.dmp

memory/1672-186-0x0000000006120000-0x0000000006474000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1eec66828ac2201cdadad3c8daedd188
SHA1 cfcabbc22ac5bb7210d1183906040d19492ff6ad
SHA256 946d8670e141984d7216d73aae7823bec1f7fc4e9c8ce2e1a040da4fe2d6826f
SHA512 538991e59f73a1d9ef84548ff6e2df71ce5df75ec634f9cb84e586b3e868a9f764151a3302a160d1c646393070b1382c31bb99c86cdb6b4970acef482b53486e

memory/1672-198-0x0000000071350000-0x00000000716A4000-memory.dmp

memory/1672-197-0x0000000070BA0000-0x0000000070BEC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2896-215-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3648-217-0x0000000002920000-0x0000000002D20000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/932-222-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4480-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/932-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2896-228-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4480-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2896-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-236-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4480-239-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2896-240-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-252-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-256-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-260-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-265-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-269-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2896-272-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 04:29

Reported

2024-05-16 04:31

Platform

win11-20240426-en

Max time kernel

150s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1028 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1028 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1028 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\system32\cmd.exe
PID 2920 wrote to memory of 2516 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\system32\cmd.exe
PID 2516 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2516 wrote to memory of 2652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2920 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 1780 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2920 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\rss\csrss.exe
PID 2920 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\rss\csrss.exe
PID 2920 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe C:\Windows\rss\csrss.exe
PID 4700 wrote to memory of 2360 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 2360 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 2360 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 1176 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 1176 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 1176 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 1168 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 1168 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 1168 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4700 wrote to memory of 964 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4700 wrote to memory of 964 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3100 wrote to memory of 1380 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 1380 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 1380 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1380 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1380 wrote to memory of 4084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe

"C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe

"C:\Users\Admin\AppData\Local\Temp\e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 6838d551-eb4f-4cb9-88ce-57a2ae04207e.uuid.statscreate.org udp
US 8.8.8.8:53 server16.statscreate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun.l.google.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server16.statscreate.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.96:443 server16.statscreate.org tcp
BG 185.82.216.96:443 server16.statscreate.org tcp
BG 185.82.216.96:443 server16.statscreate.org tcp

Files

memory/1028-1-0x0000000002A50000-0x0000000002E52000-memory.dmp

memory/1028-2-0x0000000002E60000-0x000000000374B000-memory.dmp

memory/1028-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1084-4-0x000000007405E000-0x000000007405F000-memory.dmp

memory/1084-5-0x0000000002300000-0x0000000002336000-memory.dmp

memory/1084-6-0x0000000004D20000-0x000000000534A000-memory.dmp

memory/1084-7-0x0000000074050000-0x0000000074801000-memory.dmp

memory/1084-8-0x0000000074050000-0x0000000074801000-memory.dmp

memory/1084-9-0x00000000054A0000-0x00000000054C2000-memory.dmp

memory/1084-11-0x00000000055B0000-0x0000000005616000-memory.dmp

memory/1084-10-0x0000000005540000-0x00000000055A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w1t0xyqp.k50.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1084-20-0x0000000005620000-0x0000000005977000-memory.dmp

memory/1084-21-0x0000000005B10000-0x0000000005B2E000-memory.dmp

memory/1084-22-0x0000000005B50000-0x0000000005B9C000-memory.dmp

memory/1084-23-0x00000000060E0000-0x0000000006126000-memory.dmp

memory/1084-24-0x0000000006F40000-0x0000000006F74000-memory.dmp

memory/1084-26-0x0000000070440000-0x0000000070797000-memory.dmp

memory/1084-25-0x00000000702C0000-0x000000007030C000-memory.dmp

memory/1084-36-0x0000000006F80000-0x0000000006F9E000-memory.dmp

memory/1084-27-0x0000000074050000-0x0000000074801000-memory.dmp

memory/1084-37-0x0000000006FA0000-0x0000000007044000-memory.dmp

memory/1084-38-0x0000000074050000-0x0000000074801000-memory.dmp

memory/1084-40-0x00000000070C0000-0x00000000070DA000-memory.dmp

memory/1084-39-0x0000000007710000-0x0000000007D8A000-memory.dmp

memory/1084-41-0x0000000007100000-0x000000000710A000-memory.dmp

memory/1084-42-0x0000000007210000-0x00000000072A6000-memory.dmp

memory/1084-43-0x0000000007130000-0x0000000007141000-memory.dmp

memory/1084-44-0x0000000007170000-0x000000000717E000-memory.dmp

memory/1084-45-0x0000000007180000-0x0000000007195000-memory.dmp

memory/1084-46-0x00000000071D0000-0x00000000071EA000-memory.dmp

memory/1084-47-0x00000000071F0000-0x00000000071F8000-memory.dmp

memory/1084-50-0x0000000074050000-0x0000000074801000-memory.dmp

memory/2920-52-0x0000000002A60000-0x0000000002E67000-memory.dmp

memory/2412-53-0x00000000057E0000-0x0000000005B37000-memory.dmp

memory/2412-62-0x00000000702C0000-0x000000007030C000-memory.dmp

memory/2412-63-0x0000000070530000-0x0000000070887000-memory.dmp

memory/2412-72-0x0000000006EF0000-0x0000000006F94000-memory.dmp

memory/2412-73-0x0000000007240000-0x0000000007251000-memory.dmp

memory/2412-74-0x0000000007290000-0x00000000072A5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/1780-83-0x0000000005EA0000-0x00000000061F7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7ab2557fca72642984b03cbadcb782de
SHA1 46e1b3c35e50a4baa54c8bbbd90b95effbee9e6a
SHA256 444bfd1a014ce8db180b758e1d52d621e3375acbf32b14006ff2f0e096c1a367
SHA512 9577c2178501d6e2a019323538010bfedb934ad092ea61d5fcedb88ac9242342aefbc3ab22cd1fa57ca8326542920852e1d250193380628eca0cfab00dc3f657

memory/1028-88-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1028-89-0x0000000002A50000-0x0000000002E52000-memory.dmp

memory/1028-90-0x0000000002E60000-0x000000000374B000-memory.dmp

memory/1780-91-0x00000000702C0000-0x000000007030C000-memory.dmp

memory/1780-92-0x0000000070510000-0x0000000070867000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2adb04d4b1cc84a563ff5934ff3724af
SHA1 1f25d56395d41925bc77239ef15d9d0cdf6bedf0
SHA256 d9644917d1f9c71e86f346db989e1d6ab0a94be142548d2b6392f759c7be921f
SHA512 da295eccb66077bd9005037b255eeab373147f45b1666905e91a7316d6bf5395b738da8127ccf1a27bc2cdafb34a685c393a11c4964367c3f86ef8597f3c79e1

memory/1900-111-0x00000000702C0000-0x000000007030C000-memory.dmp

memory/1900-112-0x0000000070440000-0x0000000070797000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 6004fdf731bd0126fb74902cb28b76c9
SHA1 be61eede81bf60e5a8e95644e2efe96ef6591ed9
SHA256 e664b307d9f8e935248922352b591910eea6162a4f8ec6f0783e0c66b81314fd
SHA512 0ee80a4a68ec681a82310487688c0c77af79b54d82335f5660094c72b5738b809ac4c079e727d121940e91aa3b961c825ec6bfda41cb260c1068c635773557de

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 874261eecdc4cfe229a98a35045174b9
SHA1 e433e00ed4e6cb018ee731cf3af8cb3fb295dd2f
SHA256 4ff9931fc6aa5c8f895d6ef76b551d03812346d9d85996f5f3cb3faec00e0c80
SHA512 b1b9c780c690fe9e5c32424e44db167ff486e795fcf9cb996f8eb9b4df8d87c6acf5404391691ba8aa6fca4cba928e8faf4c612264bbc45c8183eda242436eca

memory/2920-136-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2360-137-0x00000000702C0000-0x000000007030C000-memory.dmp

memory/2360-138-0x0000000070440000-0x0000000070797000-memory.dmp

memory/1176-156-0x0000000005670000-0x00000000059C7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 552ffdc98094d1771e939dba7a529116
SHA1 b28d909dfa336bffc3b0038e8034ef56624974bb
SHA256 6cefd5ba977530d6eaaaae2ced4ac1cb96ee991770f4b6a44ba8eb38ce673eb9
SHA512 dc90e49c68a97d167acdaf8043ee32b22521d28b553d035af49b95b3cb66b9eaeddccdf7b42ae7a844ed62290669f597106effba028d8f0cec284c8ac538c7a8

memory/1176-158-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

memory/1176-159-0x00000000701E0000-0x000000007022C000-memory.dmp

memory/1176-160-0x0000000070360000-0x00000000706B7000-memory.dmp

memory/1176-169-0x0000000006E20000-0x0000000006EC4000-memory.dmp

memory/1176-170-0x0000000007110000-0x0000000007121000-memory.dmp

memory/1176-172-0x00000000054E0000-0x00000000054F5000-memory.dmp

memory/1168-182-0x0000000005EC0000-0x0000000006217000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b65651b630ab0fc0458aca524f6b262e
SHA1 963af2cd933b5bce5945d6554db30a3d611f1bfd
SHA256 85d865486085fe101461f8d7f64f8f58f44aad2a8bb93c126c2916e63c35a7bb
SHA512 e783673a72eb4a324bf114a81bd7a2ff522900ec3063f718aafc5dfcaf7264db7f1fdb4d85dab29eaeacd55dcdf6e3131df16ad8f17cfed595322b38a6e346d3

memory/1168-184-0x00000000701E0000-0x000000007022C000-memory.dmp

memory/1168-185-0x0000000070410000-0x0000000070767000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4700-201-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2920-203-0x0000000002A60000-0x0000000002E67000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3100-207-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3384-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3100-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4700-214-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3384-217-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4700-216-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-222-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3384-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4700-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-230-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-242-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-254-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4700-258-0x0000000000400000-0x0000000000D1C000-memory.dmp